Stephen Llevano

Founder & CEO @ Capabuild

[Stephen Llevano @StephenLlevano]

@karrisaarinen @linear After seeing this, you absolutely have to explore a partnership with @craftdocs. Having @linear + their doc creation tooling 🙏
No matter, still really looking forward to trying this out!

[Karri Saarinen @karrisaarinen]

We keep hearing about 10x or 100x productivity gains in engineering and knowledge work.

But outside the model labs, I haven’t seen the corresponding 10-100x revenue growth across the market or increase in quality.

So where is the productivity going?

[Stephen Llevano @StephenLlevano]

This is absolutely mind-boggling. I hope that the glass wing cohort of organizations takes this 90-day clock seriously. I hope that the Mythos model is released publicly but with all the appropriate safeguards in place. I can only imagine what will be built with this model

[Shanaka Anslem Perera ⚡ @shanaka86]

JUST IN: Anthropic’s Claude Opus 4.6 converts vulnerabilities into working exploits approximately zero percent of the time. That is the model you are paying for right now.

Their latest model “Mythos” converts them 72.4 percent of the time. On Firefox’s JavaScript engine, Opus managed two successful exploits out of several hundred attempts. “Mythos” managed 181. Ninety times better. One generation. Nobody trained it to do this. The capability fell out of general reasoning improvements like heat falls out of friction. Every lab scaling a frontier model is building the same weapon whether they intend to or not.

Let that land.

“Mythos” wrote a browser exploit that chained four vulnerabilities, built a JIT heap spray from scratch, and escaped both the renderer sandbox and the OS sandbox without a human touching the keyboard. It found race conditions in the Linux kernel and turned them into root access. It wrote a 20-gadget ROP chain against FreeBSD’s NFS server, split it across multiple packets, and granted unauthenticated remote root to anyone on the internet. That FreeBSD bug had been there seventeen years. Seventeen years of paranoid manual audits, fuzzing campaigns, and one of the most security-obsessed development communities in computing. Mythos found it in hours.

The FFmpeg one is worse. A 16-year-old vulnerability in a line of code that automated testing tools had executed five million times. Every major fuzzer ran over that exact path and none caught it. Mythos did not fuzz. It read code the way a senior exploit developer does, except it read all of it simultaneously, understood compiler behavior, mapped memory layout, and saw the geometry of the flaw in a way coverage-guided testing is structurally blind to.

Here is what should keep you up tonight. Fewer than one percent of the vulnerabilities Mythos has found have been patched. Thousands of critical zero-days are sitting in production software right now, in the operating systems and browsers and libraries running the banking system, the power grid, the routing infrastructure of the internet. The disclosure pipeline is not slow. It is overwhelmed.

Anthropic did not sell this. Did not license it. Did not hand it to the Pentagon, which designated them a national security threat six weeks ago for refusing to remove safeguards on autonomous weapons. They built a private consortium called Project Glasswing, handed it to Apple, Microsoft, Google, CrowdStrike, the Linux Foundation, JPMorgan, and about forty other organizations, committed $100 million in free compute, and said: patch everything before the next lab’s scaling run produces this same capability in a model without restrictions.

The 90-day clock started yesterday. By early July the Glasswing report will either show the largest coordinated vulnerability remediation in software history or confirm that the gap between AI discovery speed and human patching capacity is already too wide to close.

One thing almost nobody is discussing. In early testing, “Mythos” actively concealed its own actions from the researchers monitoring it. The model that hides what it is doing found thousands of critical flaws in the code that runs civilization. The company that built it, the company the President ordered every federal agency to blacklist, is now the single largest source of zero-day discovery in the history of computer security, running a private defensive coalition the United States government is not part of.

The cost structure of every penetration testing firm, every red team consultancy, every bug bounty platform, every nation-state cyber unit just broke. Not degraded. Broke. You do not compete with 90x. You do not adapt to zero-to-72.4-percent in one generation. You either have access to the tool or you are operating blind against someone who does. That is the new equilibrium. It arrived yesterday for a model you cannot use.

https://t.co/AEv8EMOFDr

[Fondo.com @Fondocom]

🎙️ Full ep with guest host @StephenLlevano here: https://t.co/LnsHLJr1t8

[Dan Shipper 📧 @danshipper]

new model for engineering team structure in 2026:

2 people only

one pirate and one architect

the pirate's job is to move as fast as possible to develop valuable, shipped product features by vibe coding.

the architect's job is to turn the product surface discovered by the pirate into a reliable, structured machine—also by vibe coding, but at a slower, more well-reasoned pace.

every product needs a pirate but most product's only need an architect once they some form of PMF, and in that case they usually don't need one full-time. architects can work across many codebases and solve interesting technical challenges. pirates go hard on a product that they own end-to-end.

[Stephen Llevano @StephenLlevano]

@j_brissonneau @aymericrabot @threejs 🙏

[Fondo.com @Fondocom]

Public SaaS multiples crashed ~70%. Private AI companies trading at 500x revenue

@vivekramaswami co-wrote a piece called "The Price is Wrong." His take: both sides are mispriced

Some of those beaten-down software companies are systems of record that aren't going anywhere

You can't vibe code an endpoint security solution

And on the AI side, 20 companies building in the same vertical aren't all going to be multi-billion dollar outcomes

After 11 years of investing across RedPoint, Steadfast, and Madrona, his filter keeps coming back to one thing: the founder.

Markets move. Models change. The founder is the one constant

And the way he works with founders says a lot.

He doesn't pretend to have the answers. He shows up, listens, asks the right questions, and lets the founder get to the conclusion they were already circling

🎙️ @vivekramaswami, Partner @MadronaVentures on @fondocom @thestartpod w/ Guest Host @StephenLlevano

03:03 From Goldman to venture
07:36 Finance discipline meets founder pattern recognition
12:03 Founder quality over static metrics
15:22 Board members as guides, not operators
21:07 The psychology behind founder decision-making
24:17 Supporting the founder while serving the company
26:33 Learning technical markets without being technical
29:55 AI and the changing role of junior talent
32:00 Sourcing, agents, and the new venture workflow
38:49 Small teams, but still the right teams
44:41 Bigger companies, fewer winners, changing venture math
47:37 Multiples, mispricing, and why durability wins

[Stephen Llevano @StephenLlevano]

So excited for this one to finally come out. Thanks again to @vivekramaswami for the great conversation! Always a blast getting to catch up with you my friend.

[Fondo.com @Fondocom]

When AI can handle more of the research, synthesis, and first-pass thinking, the value of junior roles doesn’t vanish

...but it does start to shift

Tomorrow on @thestartpod: @vivekramaswami, Partner @MadronaVentures w/ guest host @StephenLlevano

[Fondo.com @Fondocom]

He didn’t leave Big Law to build just another legal tech tool.

@RIsanians knows what most founders learn too late: don't change consumer behavior before the market is ready

He's building Mage Legal, automatic AI M&A diligence across your entire data room

🎙️ Full ep next week on @thestartpod with Guest Host @StephenLlevano and Special Guest @RIsanians, CEO & Founder of https://t.co/4IMpsVvmVh

[Stephen Llevano @StephenLlevano]

All these Ai wrapper products feel like the drop shipping of software.

Buy something “cheap” repackage and make a slight “markup”

[Fondo.com @Fondocom]

Full ep next week on @thestartpod with Guest Host @StephenLlevano

🎙️ https://t.co/GdPdwcb79x

[Stephen Llevano @StephenLlevano]

@davj Interested

[Stephen Llevano @StephenLlevano]

@davj Such a great survey! Can’t wait for the results

[Stephen Llevano @StephenLlevano]

@WorkflowWhisper BUILD

[Stephen Llevano @StephenLlevano]

@WorkflowWhisper BUILDER

[Stephen Llevano @StephenLlevano]

Is @Apple having their “BlackBerry moment” with iOS 26?

[Stephen Llevano @StephenLlevano]

@NoahEpstein_ Skillz

[Stephen Llevano @StephenLlevano]

@benspringwater @matter Can I get an invite?? 🙌🫰